It is a common practice that when abnormality occurs in a component of a communication network, it is notified to a management system of the communication network as an alarm and recorded in a log. Maintenance staff of the communication network estimates a fundamental factor of abnormality based on time series information of an alarm recorded in a log and his/her own experience to evaluate the degree of effect exerted on communication service and when improvement is required of the communication network or other case, determines that a failure occurs.
In general, because a management system of a large-scale communication system is daily notified of numbers of alarms, a maintenance staff who manually analyzes a log requires a lot of labor. In addition, since when abnormality occurs on the communication network, numbers of related alarms might occur in chain reaction to hide a crucial alarm suggesting a fundamental factor of the abnormality, a lot of experiences are required for estimating a fundamental factor of abnormality from a log. Under these circumstances, systems for supporting log analysis of this kind and systems for aggregating redundant alarms have been proposed.
One example of art related to a system for supporting log analysis is recited in Japanese Patent Laying-Open No. 2004-318552 (Literature 1). The log analysis supporting system recited in Literature 1 is a system which monitors a log of an intrusion sensing system connected to a communication network to individually observe the number of occurrences of an event (access action) per unit time and calculates and presents the degree of abnormality to notify a manager of an event having abnormal change in the amount of observation. The log analysis supporting system has a function of comparing the amount of observation of logs of a plurality of intrusion sensing systems to determine that the amount of observation is abnormal when a comparison result has a difference larger than a predetermined value.
One example of art related to a system for aggregating redundant alarms is recited in Japanese Patent No. 3082548 (Literature 2). The alarm selection system recited in Literature 2 checks a statistical correlation among alarm occurrence times to classify alarms into units each having synchronicity in which an alarm occurs at the same time or occurs with a fixed time delay, thereby generating a plurality of sets of alarms. Thereafter, by selecting a set of alarms most closed to an occurring event, numerous redundant alarms are aggregated into crucial alarms.    Literature 1: Japanese Patent Laying-Open No. 2004-318552.    Literature 2: Japanese Patent No. 3082548.    Literature 3: Noboru Murata, *Introduction: Independent Component Analysis, *Tokyo Electric University Publishing, 2004.
The above-described related art, however, has a problem that a failure of a communication network can not be detected according to objective basis while comprehensively taking a plurality of alarms output by a management server of the communication network in consideration.
The reason is that while the related art provides a unit for presenting abnormality of an individual alarm, it fails to provide a unit for determining whether a state of a communication network has a failure or not according to an objective basis by integrating these information. When the number of occurrences of each of all the alarms is close to a limit of a normal range to bring the network into an abnormal state as a whole, for example, because the number of occurrences of an individual alarm is within the normal range, the related art is incapable of detecting the abnormality.
According to the present invention, a factor causing a state of output of a single alarm by an alarm system is defined as a less significant factor and a factor causing a state of output of a plurality of alarms in chain reaction is defined as a more significant factor. In this case, the above-described related art has a problem that a degree of abnormality of a communication network can not be evaluated tracing back to a more significant factor.
The reason is that while the related art provides a unit for presenting a degree of abnormality of a single alarm caused by a less significant factor and a unit for classifying alarms into a unit having synchronicity based on time correlation related to an occurrence time and extracting a more significant factor, it fails to provide a unit for estimating a degree of abnormality of a network based on the more significant factor. When a plurality of different more significant factors cause the same alarm, for example, a more significant factor whose effect exerted on a change of the number of occurrences of the alarm in question is weak is buried in variation of other more significant factors whose effects are strong, so that only by monitoring variation in the number of occurrences of the alarm in question or classifying the alarm as is executed by the related art, the more significant factor whose effect is weak can not be detected. This is in particular a serious problem when the frequency of occurrence of alarms due to a more significant factor causing a fatal failure is low.
The above-described related art has a further problem that a state of a communication network to be monitored during a monitoring period can not be evaluated from various aspects.
The reason is that the related art fails to provide a unit for specifically realizing a function of comparing the numbers of alarms obtained from a plurality of management targets to detect their abnormalities, and detects only abnormality of an individual alarm, so that it is impossible to simultaneously compare a state of a geographically adjacent communication network during a monitoring period and a state of the communication network in question as of prior to the monitoring period to comprehensively determine a state of the communication network.
An object of the present invention is to provide a system for analyzing an alarm of a communication network to comprehensively consider occurrence states of a plurality of alarms and evaluating a degree of abnormality of the communication network tracing back to a more significant factor causing the alarm to detect a failure of the communication network based on an objective basis.
A further object of the present invention is to provide a system for detecting a failure of a communication network by simultaneously comparing a state of a communication network to be monitored during a monitoring period with a state of a geographically adjacent communication network during the monitoring period and a state of the communication network in question as of prior to the monitoring period to evaluate a state of the communication network from various aspects.